Method for preventing misuse of a cryptographic key

FIELD

The present disclosure generally relates to a method for preventing misuse of a cryptographic key.

BACKGROUND

A firewall is a tool used to monitor access to a network, and ensure that only authorized traffic is allowed. A key-misuse protection engine can serve as a cryptography firewall, monitoring usage of cryptographic keys of all types, and ensuring that only legitimate operations using the key are allowed. It is crucial that the key-misuse mechanism cannot be bypassed by directly breaching a machine that issues a request.

Existing hardware security modules (HSMs) do not effectively protect against key misuse, as they only offer basic authentication and authorization mechanisms. Clients of an HSM are commonly machines that are authorized to use certain keys. One only needs to breach or have access to such machines, in order to command the HSM and use its keys. An attacker breaching any machine that is authorized to access an HSM and request cryptographic operations can carry out those operations exactly like a legitimate application. In some important cases, it suffices to misuse a key once in order to carry out a devastating attack. For example, a single misuse of a root Certificate authority (CA) key can provide an attacker with a legitimate certificate that can be used to impersonate legitimate entities in the system, a single misuse of a code signing key can enable an attacker to distribute malware that is accepted by all as valid code, and a single misuse of a signing key for crypto-assets is all that is needed to steal all of the funds protected by that key. In addition to the above, a lot of damage can be made by an attacker fraudulently using decryption and other keys. This critical security issue is simply not dealt with by HSMs and other key stores today, beyond verifying that the client connecting is generally authorized. This is a critical flaw in existing cryptographic infrastructure.

SUMMARY

In one aspect of the invention a method is provided for preventing misuse of a cryptographic key, the method including receiving a request to carry out a cryptographic operation using a cryptographic key from a requesting entity, distributing the request to a quorum including multiple computerized devices, receiving a decision from the multiple computerized devices on whether or not the cryptographic operation using the cryptographic key is allowed, carrying out the cryptographic operation using the cryptographic key according to the decision from the multiple computerized devices.

In some cases, at least one of the multiple computerized devices is controlled by a person. In some cases, the method further includes evaluating a complexity level of the request and determining the multiple computerized devices in the quorum based on the complexity level. In some cases, the computerized devices in the quorum determine whether or not to allow the cryptographic operation using the cryptographic key based on a policy.

In some cases, the method further includes updating a policy in at least one of the computerized devices in the quorum. In some cases, the policy is identical in all the computerized devices in the quorum. In some cases, the policy is different among at least two of the computerized devices in the quorum. In some cases, the method further includes evaluating a complexity level of the request, updating the policy in at least some of the computerized devices in the quorum based on the complexity level of the request. In some cases, the multiple computerized devices perform an MPC process, wherein the decision is an output of the MPC process.

In some cases, the method further includes the multiple computerized devices performing a checking process for the requesting party, the multiple computerized devices providing multiple signatures attesting to the checking process, an entity who agrees to carry out the cryptographic operation verifying that the cryptographic operation meets the policy, the entity who agrees to carry out the cryptographic operation verifying that the signatures from the multiple computerized devices are valid.

In some cases, the method further includes the multiple computerized devices performing a checking process for the requesting party, the multiple computerized devices providing multiple signatures attesting to the checking process, two or more entities holding shares of the cryptographic key who agree to carry out the cryptographic operation verifying that the cryptographic operation meets the policy, the two or more entities verifying that the multiple signatures received from the multiple computerized devices are valid, the two or more entities performing an operating MPC process using the shares of the cryptographic key to carry out the cryptographic operation.

In some cases, the method further includes the multiple computerized devices performing a checking process for the requesting party, the multiple computerized devices running a signature MPC process to generate a single signature attesting to the checking process, an entity who agrees to carry out the cryptographic operation verifying that the cryptographic operation meets the policy, an entity who agrees to carry out the cryptographic operation verifying that single signature from the multiple computerized devices is valid.

In some cases, the method further includes the multiple computerized devices performing a checking process for the requesting party, the multiple computerized devices running a signature MPC process to generate a single signature attesting to the checking process, two or more entities holding shares of the cryptographic key who agree to carry out the cryptographic operation verifying that the cryptographic operation meets the policy, two or more entities holding shares of the cryptographic key who agree to carry out the cryptographic operation verifying that the signature from the multiple computerized devices is valid, the two or more entities performing an operating MPC process using the key shares to carry out the cryptographic operation.

In some cases, the method further includes the multiple computerized devices performing a checking process for the requesting party, the multiple computerized devices and the two or more entities holding shares of the cryptographic key, the multiple computerized devices and the two or more entities agree to carry out the cryptographic operation verifying that the cryptographic operation meets the policy, the multiple computerized devices and the two or more entities running an operating MPC process to carry out the cryptographic operation on the shares.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention may be more clearly understood upon reading of the following detailed description of non-limiting exemplary embodiments thereof, with reference to the following drawings, in which:

<figref idref="DRAWINGS">FIG. <b>1</b></figref> discloses a computerized environment for preventing misuse of a cryptographic key, according to exemplary embodiments of the subject matter;

<figref idref="DRAWINGS">FIG. <b>2</b></figref> discloses a method for preventing misuse of a cryptographic key, according to exemplary embodiments of the subject matter;

<figref idref="DRAWINGS">FIG. <b>3</b></figref> discloses a method for outputting a decision on whether or not to allow access to a cryptographic key, according to exemplary embodiments of the subject matter; and,

<figref idref="DRAWINGS">FIG. <b>4</b></figref> discloses a method for using a multi-party computation when computing a decision on whether or not to allow access to a cryptographic key, according to exemplary embodiments of the subject matter.

The following detailed description of embodiments of the invention refers to the accompanying drawings referred to above. Dimensions of components and features shown in the figures are chosen for convenience or clarity of presentation and are not necessarily shown to scale. Wherever possible, the same reference numbers will be used throughout the drawings and the following description to refer to the same and like parts.

DETAILED DESCRIPTION

Illustrative embodiments of the invention are described below. In the interest of clarity, not all features/components of an actual implementation are necessarily described.

The invention, in embodiments thereof, discloses a system and method for using a quorum having multiple computerized devices in order to prevent misuse of a cryptographic key. Use of the cryptographic key is requested by a party in order to carry out cryptographic operations for any client that is authenticated. The quorum of multiple computerized devices, also defined below as quorum, may output a decision on whether or not to approve use of the cryptographic key, thereby enabling or disabling the cryptographic operation.

The quorum may include machines and/or of humans, as humans approve via a machine, such as a mobile device or personal computer. The quorum may be defined according to a person skilled in the art, for example 3 votes out of 5 devices, 1 vote out of 2 and the like. The quorum may change for a specific cryptographic key. The quorum may change according to the party requesting access to the cryptographic key.

Human approvers are likely to be used for extremely critical operations that happen occasionally, such as like code signing on a final release or a large transfer of crypto-assets, and machine-only quorums can be used for high frequency operations. Importantly, quorum authorization is cryptographically enforced, and so there is no machine in the network that can be accessed to bypass it. Quorum authorization can also be used to define maker/checker workflows for business transactions that are cryptographically enforced.

The method for preventing misuse of a cryptographic key may utilize a policy engine. The policies may be used by the computerized devices in the quorum to decide whether or not to enable access to the cryptographic key. The policies may vary among different computerized devices, or vary according to the cryptographic operation desired to be performed based on a request received from a party requesting to access the cryptographic key. Some policies may be enforced by multiple entities. A policy is defined as a set of rules that governs if an operation is allowed to take place. The set of rules may be dynamic and updated over time. The update may be based on information collected by at least some of the multiple computerized devices of the quorum. The rules in the policies may consider basic elements like time of day, devices' location and rate limiting to advanced checks like Know your Customer (KYC) protocols, Anti Money Laundering (AML) for financial transactions, fraud detection, anomaly detection tools (queried before and not after the operation), and any other computerized technology, technique or tool. Utilizing quorum authorization, the policy can be cryptographically enforced at multiple points, ensuring that no single element can be bypassed. The result is a policy that can be defined centrally and enforced in a distributed manner.

<figref idref="DRAWINGS">FIG. <b>1</b></figref> discloses a computerized environment for preventing misuse of a cryptographic key, according to exemplary embodiments of the subject matter. The computerized environment includes a requesting party <b>120</b> that requests to carry out a cryptographic operation using a cryptographic key. The request may be received over any communication network, protocol or technique desired by a person skilled in the art, such as over the internet, by inputting a request into a dedicated interface, into a software application and the like. The requesting party <b>120</b> may be a personal computer, laptop, cellular phone, server, tablet and the like. The requesting party <b>120</b> includes a communication unit configured to exchange information with another device.

The computerized interface also includes a quorum <b>110</b> having multiple computerized devices <b>111</b>, <b>112</b>, <b>113</b>, <b>114</b>, <b>115</b> and <b>116</b>. The devices may be of the same type, or of various types. For example, a quorum of 5 devices may contain two cellular phones, a server and two laptops. The multiple computerized devices <b>111</b>, <b>112</b>, <b>113</b>, <b>114</b>, <b>115</b> and <b>116</b> receive the request to carry out a cryptographic operation using a cryptographic key and output a decision on whether or not to allow the cryptographic operation requested by the requesting party <b>120</b> to be carried out, using the appropriate cryptographic key. The decision may be independent by each device of the multiple computerized devices <b>111</b>, <b>112</b>, <b>113</b>, <b>114</b>, <b>115</b> and <b>116</b>, or may be an output of a process in which the multiple computerized devices <b>111</b>, <b>112</b>, <b>113</b>, <b>114</b>, <b>115</b> and <b>116</b> exchange information.

The computerized environment also includes multiple computerized entities, such as two entities <b>130</b>, <b>135</b> configured to assist in preventing misuse of a cryptographic key. The two entities <b>130</b>, <b>135</b> may be part of the quorum <b>110</b>, or may be excluded from the quorum <b>110</b>. The entities <b>130</b>, <b>135</b> include processors and a set of rules for verifying that signatures received from the multiple computerized devices are valid. The entities <b>130</b>, <b>135</b> may be servers, or any other type of electronic devices. The entities <b>130</b>, <b>135</b> exchange information with at least some of the computerized devices in the quorum <b>110</b>, for example for verifying the validity of the information provided from the devices in the quorum <b>110</b>.

The entities <b>130</b>, <b>135</b> may include shares of a secret, such as a cryptographic key required to perform the cryptographic operation requested by the requesting party <b>120</b>. The shares may be used to perform a multi-party computation (MPC) process between the entities <b>130</b>, <b>135</b>. The output of the MPC process is the cryptographic operation requested by the requesting party.

The parties or devices <b>111</b>, <b>112</b>, <b>113</b>, <b>114</b>, <b>115</b> and <b>116</b>, <b>120</b>, <b>130</b> and <b>135</b> may include communication modules configured to enable communication over a network, such as the internet, such as using an internet gateway, local access network, wide access network and the like. The communication modules may also operate over a non-internet communication channel, for example using wired communication, fiber optics, USB, or wireless communication such as Bluetooth and the like.

Each of the parties or devices <b>111</b>, <b>112</b>, <b>113</b>, <b>114</b>, <b>115</b> and <b>116</b>, <b>120</b>, <b>130</b> and <b>135</b> may also have a memory unit, or access to a memory unit located in a remote device working uniquely with a specific party of the parties or devices <b>111</b>, <b>112</b>, <b>113</b>, <b>114</b>, <b>115</b> and <b>116</b>, <b>120</b>, <b>130</b> and <b>135</b>. The memory unit may be either volatile memory or non-volatile memory. The memory unit may store instructions for performing the process elaborated below. The memory unit may also store the shares of the secret known to each of the parties <b>130</b> and <b>135</b>.

Each of the parties or devices <b>111</b>, <b>112</b>, <b>113</b>, <b>114</b>, <b>115</b> and <b>116</b>, <b>120</b>, <b>130</b> and <b>135</b> may also have a processing module configured to manage the part of the process performed in each party. The processing module may be a processor, a CPU, a microprocessor, either implemented in software, hardware or firmware.

<figref idref="DRAWINGS">FIG. <b>2</b></figref> discloses a method for preventing misuse of a cryptographic key, according to exemplary embodiments of the subject matter.

Step <b>210</b> discloses receiving a request to carry out a cryptographic operation using a cryptographic key from a requesting entity. The cryptographic operation may be, for example, encryption, decryption, signing messages, key derivation and the like. The request may include specification concerning the cryptographic operation. The specification may include a third party related to the cryptographic operation, such as a bank or another institution holding encrypted information that the requesting party wishes to access. The specification may further include information required to assess whether or not the requesting party is entitled to perform the cryptographic operation, such as signatures, documents, cryptographic operations performed by the requesting party, and the like.

Step <b>220</b> discloses distributing the request to a quorum including multiple computerized devices. The distribution includes sending the request to the multiple computerized devices. Sending may be performed over the internet. Sending may be performed by storing the request in a memory address accessible to the multiple computerized devices and sending a notification to the multiple computerized devices that the request is in a specific memory address.

Step <b>230</b> discloses receiving a decision from the multiple computerized devices on whether or not the requested cryptographic operation using the cryptographic key is allowed. The decision may be outputted from each of the multiple computerized devices separately. The computation resulting in the decision may be performed locally in each multiple computerized devices or on a server located in a remote device, or a combination of both. The decision may be outputted from a computation performed in cooperation by at least two of the multiple computerized devices. The cooperation may include a multi-party computation (MPC) process performed by the multiple computerized devices, in which the multiple computerized devices exchange information stored in each multiple computerized devices.

Step <b>240</b> discloses carrying out the cryptographic operation using the cryptographic key according to the decision from the multiple computerized devices. The cryptographic operation may be executed using an operating MPC process in case the cryptographic key is stored in shares, not in its entirety, among multiple entities, such that the shares are not revealed to other entities during the MPC process.

<figref idref="DRAWINGS">FIG. <b>3</b></figref> discloses a method for using a policy when computing a decision on whether or not to allow access to a cryptographic key, according to exemplary embodiments of the subject matter.

Step <b>310</b> discloses outputting a policy to the multiple computerized devices. The policy includes a set of rules used by the multiple computerized devices to decide whether or not to allow the cryptographic operation requested by the requesting party. The set of rules may be identical for all the multiple computerized devices, or may vary among the multiple computerized devices. The set of rules may vary based on device type, for example policy “A” for cellular phones and policy “B” for laptops. The policy may be outputted by sending a message over the internet.

Step <b>320</b> discloses updating the policy in the multiple computerized devices. Updating may be performed periodically, for example once a week after reviewing requests in the previous week, or in response to an event, such as failure to protect a key, or a burst of requests which exceeds normal behavior.

Step <b>330</b> discloses receiving a request to carry out the cryptographic operation. The request may be initiated by a requesting party, such as a server, or a person operating an electronic device. The request may include request specification, such as type of cryptographic operation, data to be accessed after performing the cryptographic operation, IP address of a server holding the data, IP address of a device holding the cryptographic key or key shares, and the like.

Step <b>340</b> discloses evaluating a complexity level of the request. The complexity level may depend on prior knowledge of the requesting party, location of the requesting party, organization from which the requesting party sent the request, type of cryptographic operation, amount and sensitivity of data to be accessed after carrying out the cryptographic operation and the like. The complexity level may be evaluated by a server, by a device which is part of the quorum, and the like.

Step <b>350</b> discloses determining the multiple computerized devices in the quorum based on the complexity level. For example, requests having a high complexity level may require more than <b>11</b> devices, while requests having a low complexity level may require only <b>5</b> devices.

Step <b>360</b> discloses updating the policy in at least some of the computerized devices in the quorum based on the complexity level of the request. The rules assembling the policy may be more strict in case the sensitivity of the data requested in the request is high, thereby limiting access to the specific data only to requesting parties having unique properties, such as unique certificates, signatures, origin, and the like.

<figref idref="DRAWINGS">FIG. <b>4</b></figref> discloses a method for using a multi-party computation when computing a decision on whether or not to allow access to a cryptographic key, according to exemplary embodiments of the subject matter.

Step <b>410</b> discloses the multiple computerized devices performing a checking process for the requesting party. The checking process includes verifying the request and other relevant information against the set of rules.

Step <b>420</b> discloses the multiple computerized devices providing one or more signatures attesting to the checking process. The signature may be generated as a result of a signature MPC process performed by the multiple computerized devices. During the signature MPC process, the multiple computerized devices exchange information with each other.

Step <b>430</b> discloses the entity who agrees to carry out the cryptographic operation verifying that the signatures from the multiple computerized devices are valid. If the entity receives an authorized quorum of valid signatures, or a signature generated with an MPC process requiring an authorized quorum, then the entity knows that the quorum has approved the operation.

Step <b>440</b> discloses the entity who agrees to carry out the cryptographic operation verifying that the cryptographic operation meets the policy. This step is carried out to ensure that all entities involved have verified that the policy is met.

Step <b>450</b> discloses the two or more entities performing an operating MPC process using the shares of the cryptographic key to carry out the cryptographic operation. During the operating MPC process, the two or more entities holding the shares exchange information with each other. The shares of the cryptographic key are not revealed to other entities during the MPC process.

While the disclosure has been described with reference to exemplary embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings without departing from the essential scope thereof. Therefore, it is intended that the disclosed subject matter not be limited to the particular embodiments disclosed.